Re: selinux and rsync backup to zfs dataset

08.06.2026 16:14, [email protected] wrote:
> On Sonntag, 7. Juni 2026 22:01:17 Mitteleuropäische Sommerzeit Andrei
> Borzenkov wrote:
>> 07.06.2026 22:33, [email protected] wrote:
>>>> You can skip security.selinux extended attribute with "--filter=-x
>>>> security.selinux", but then all labels are lost.
>>>
>>> That didn't help, I still get
>>>
>>>>>>> rsync: [receiver] rsync_xal_set:
>>>>>>> lremovexattr("<file>","security.selinux") failed: Permission
>>>>>>> denied
>>>>>>> (13)
>>>
>>> unless I omit --xattrs!
>>
>> leap16:/tmp/extfs.selinux # dd if=/dev/urandom of=test count=1
>> 1+0 records in
>> 1+0 records out
>> 512 bytes copied, 0.000154908 s, 3.3 MB/s
>> leap16:/tmp/extfs.selinux # cmp ./test ../extfs.mnt/test
>> ./test ../extfs.mnt/test differ: byte 1, line 1
>> leap16:/tmp/extfs.selinux # rsync -a --xattrs --verbose
>> /tmp/extfs.mnt/test  ./
>> sending incremental file list
>> test
>> rsync: [receiver] rsync_xal_set:
>> lremovexattr("/tmp/extfs.selinux/.test.7T0w2R","security.selinux")
>> failed: Permission denied (13)
>>
>> sent 616 bytes  received 36 bytes  1,304.00 bytes/sec
>> total size is 512  speedup is 0.79
>> rsync error: some files/attrs were not transferred (see previous
>> errors) (code 23) at main.c(1347) [sender=3.4.1]
>> leap16:/tmp/extfs.selinux # rsync -a --xattrs --filter="-x
>> security.selinux" --verbose /tmp/extfs.mnt/test  ./
>> sending incremental file list
>>
>> sent 56 bytes  received 12 bytes  136.00 bytes/sec
>> total size is 512  speedup is 7.53
>> leap16:/tmp/extfs.selinux # cmp ./test ../extfs.mnt/test
>> leap16:/tmp/extfs.selinux #
> 

I noticed that the test was wrong, the second time it did not transfer 
any file at all. I repeated it and it still worked :)

> BKUP_OPTIONS=(
>    --archive --one-file-system
>    --hard-links --acls --xattrs
>    --numeric-ids
>    --delete-excluded --delete-during
>    --filter="-x security.selinux"
>    --filter=${FILTERFILE}
>    --exclude-from=${EXCLFILE}
>    --verbose --stats --no-human-readable
> )
> 
> /usr/bin/rsync "${BKUP_OPTIONS[@]}" "${FS}" "${BKUPTARGET}"
> 
> leads to
> 
> rsync: [receiver] rsync_xal_set:
> lremovexattr("<targetfile>","security.selinux") failed: Permission
> denied (13)
> 
> for the target files.
> 
> Not sure, why it works for you. Can it be a difference between local and
> remote?

Remote seems to work too.

leap16:/tmp/extfs.selinux # dd if=/dev/urandom of=test count=1
1+0 records in
1+0 records out
512 bytes copied, 0.000303926 s, 1.7 MB/s
leap16:/tmp/extfs.selinux # rsync -a --xattrs --filter="-x 
security.selinux" --verbose /tmp/extfs.mnt/test  ./
sending incremental file list
test

sent 615 bytes  received 35 bytes  1,300.00 bytes/sec
total size is 512  speedup is 0.79
leap16:/tmp/extfs.selinux # dd if=/dev/urandom of=test count=1
1+0 records in
1+0 records out
512 bytes copied, 0.00073311 s, 698 kB/s
leap16:/tmp/extfs.selinux # rsync -a --xattrs --filter="-x 
security.selinux" --verbose localhost:/tmp/extfs.mnt/test  ./
(root@localhost) Password:
receiving incremental file list
test

sent 72 bytes  received 615 bytes  152.67 bytes/sec
total size is 512  speedup is 0.75
leap16:/tmp/extfs.selinux #

Try increasing verbosity. Also, you have a lot of other options, maybe 
some of them have this side effect. Start with a simple case and build up.